my NETSCOUT Aircheck G2 calls me slow :(

As we’re all getting used to our nifty new gadget, we’re bound to scratch our heads over a few things. My honorary Canadian friend MeruMitch and I were noting a particular output from the G2 which seemed odd.

I’m connected to my AP at a data rate of 867Mbps:

Wifi Signal is the shizzle

And a quick Wifi Perf says I can push 115 Mbps of actual throughput (wireless to wireless over one AP):

But the G2 is adamant that my connection rate is 24 Mbps:

Um… Wha?

Well let’s think about this for a minute…

The G2 shows a “PHY Data Rate” of 780 Mbps connecting itself to that AP:

And if we check the G2 manual:

Ok, so that makes sense. This is what we’re expecting to see, and if you watch this field, it fluctuates a bit in the the 780-867 Mbps range.

So what then is the “Connection Rate” which is stuck at 24Mbps? Again from the user guide:

Interesting! Now I bet some of you are thinking that 24Mbps must be a basic rate in this WLAN; and you would be correct!

The key here is that the G2 is looking at the data rate of individual frames, no averages, and showing us only the last frame’s rate.

So let’s grab a basic pcap and take a look. Forgive me, this pcap is of my iPhone 6S+ rather than the MBP that I started this post with, but the relevant bits are the same. The iPhone was associated to an AP with a maximum data rate of 300 Mbps, and the G2 stayed fixed on the connection rate of 24 Mbps.

This pcap is of my iPhone doing a speed test, and I’ve filtered it to only show frames from the client, based on that definition from the G2 guide above.

Most of the data, by Bytes, is in data packets:

There are a total of 22,508 Bytes sent by my iPhone, and 8,510 Bytes are data packets using the 300 Mbps data rate (38% of the captured Bytes, matching the pic above). 33.5% of the Bytes are sent at 24Mbps… surely the G2 should have, even briefly, shown something at 300Mbps?

But the G2 isn’t looking at Bytes… it’s looking frame by frame! Look at the data rates of each frame:

Better yet, let’s change the previous output to see the numbers for each frame:

Ok well my iPhone sent 87 frames at 300 Mbps, and 300 at 24Mbps, clearly the majority of frames. This is a good explanation why the G2 appears to say that the connection rate is always 24Mbps.

It goes to show how important it is to know how to interpret what our tools are telling us. Note that only data frames in my capture were sent at the 300Mbps data rate. The control frames and some of the data frames are all sent at 12/24Mbps – our basic rates. Which is a nice plug for CWAP!

Now I’m not really sure how useful the “connection rate” field really is in its current form. Showing the last frame rate seems less useful than showing the “PHY data rate” that the G2 uses when it connects to an AP itself.

I’d love to hear what anyone else thinks of the “connection rate” field…